{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Arpit Jain for reporting this issue.", "bugzilla": {"description": "undertow: undertow: ChunkReader message length permits chunk-size overflow", "id": "2528758", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528758"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request."], "name": "CVE-2026-91920", "public_date": "2026-10-29T12:11:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-91920\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91920"], "statement": "The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires specific TCP segmentation control to smuggle requests. Successful exploitation allows an attacker to bypass security controls or poison web caches by smuggling a second request within the first. The vulnerability's root cause is an incomplete bounds check in the chunked transfer encoding parser.", "threat_severity": "Moderate"}

{}